CVE-2020-4089

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. This vulnerability could result in files from the user's filesystem or connected network filesystems being leaked to a third party. All versions of HCL Notes 9, 10 and 11 are affected.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
HCL	HCL Notes	All versions of HCL Notes v9; All versions of HCL Notes v10; All versions of HCL Notes v11

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080343Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080343Vendor Advisory

Timeline

Published: Jun 26, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40925.3"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not CVE-2020-40956.0"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can CVE-2020-40976.8In HCL Notes version 9 previous to release 9.0.1 FixPack 10 Interim Fix 8, version 10 previous to release 10.0.1 FixPack 6 and version 11 pr CVE-2020-40997.5The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures CVE-2020-41004.4"HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which components of the applic CVE-2020-41019.8"HCL Digital Experience is susceptible to Server Side Request Forgery."CVE-2020-41026.7HCL Notes is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enab CVE-2020-41045.4HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. An attacker can use XSS to send a mali CVE-2020-41077.8HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could expl CVE-2020-41258.1Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some CVE-2020-41265.9HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the coo CVE-2020-41276.5HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into accessing a system und